@shivaedev/server 0.9.1 → 0.9.3

package/CHANGELOG.md

@@ -0,0 +1,178 @@
+# Changelog
+
+## 0.9.3 - 2026-10-31
+
+### Fixed
+
+- Include `CHANGELOG.md` in published package contents so release notes are available in `node_modules`.
+- Release checks reject published package `files` lists that omit `CHANGELOG.md`, naming the package and how to include it.
+- Server RPC failures, request diagnostics and traces use the sensitive keys from their own RPC schemas, so registering another RPC cannot redact their public failure tags or messages.
+- Admin Jobs schemas mark job payload and failure-detail containers sensitive without marking generic `_tag` or `message` fields sensitive.
+- End hosted live subscriptions with `Unauthorized` when the original session is signed out, revoked or expired, whether detected during a change hint or periodic revalidation. Keep `QueryReadDenied` for a signed-in viewer whose query policy refuses the read.
+- Batch shared socket session lookups with an Effect scheduler yield so advancing `TestClock` past `streamRevalidationInterval` completes revalidation without another clock advance.
+- Preserve typed session-provider failures during hint-time authorization instead of reporting them as read-policy refusals.
+
+## 0.9.2 - 2026-10-30
+
+### Changed
+
+- Release with updated workspace dependencies.
+
+## 0.9.1 - 2026-10-30
+
+### Changed
+
+- Release with updated workspace dependencies.
+
+## 0.9.0 - 2026-10-30
+
+### Added
+
+- Queries can opt into `live: "rerun-and-compare"`. Hosted subscriptions rerun the authorized query as the subscribed viewer, hash its JSON-schema-encoded result with SHA-256, and push a typed `Result` only when it changes. Bound queries consume those results without a client refetch. Other queries keep hint-and-refetch delivery.
+- Rerun subscriptions end with `QueryReadDenied` when access is denied. The host registers change listeners before its initial result read, and reconciliation reruns the query through the same read policy.
+
+### Breaking
+
+- `@shivaedev/contract`'s `ChangesClient` transport helper now covers result messages and erases query-specific stream failures. Consumers using that helper to read changes must use their contract's native AtomRpc client type instead; derive message and failure types with `Rpc.SuccessChunk` and `Rpc.ErrorExit` of the contract's `$changes` RPC. Contract-derived bound query types remain specific to their query.
+
+## 0.8.0 - 2026-10-30
+
+### Fixed
+
+- Live reads and change subscriptions preserve policy failures instead of reporting read denial. Generated starter apps report notes database connection failures as `ServiceUnavailable` during the owner's live read.
+
+### Breaking
+
+- Query read policies declare their error and service channels with `QueryReadPolicy<Payload, E, R>`. Declare policy errors in the query's `rejections` and provide policy services when building its handler Layer. Custom subscription adapters call `querySubscription(rpc, references, viewer)` instead of resolving requests themselves. Use the native RPC type when calling `authorizeReads` or `resolveChanges` so their inferred channels include policy requirements and errors. The generated change stream includes the queries' declared rejections and service requirements; consumers handling that stream must handle those errors too.
+- Admin pages install their permission's read policy for every query, preserving additional query restrictions. Remove repeated page-grant policies from individual queries and supply the page's permission middleware with the handler Layers.
+
+## 0.7.0 - 2026-10-30
+
+### Added
+
+- Identity exposes a socket-scoped session coordinator for hosts to share session rechecks within a batch and drive stream revalidation from one timer.
+
+### Fixed
+
+- Hosted live subscriptions on one socket share hint-time session lookups and periodic session revalidation while retaining per-query read-policy checks and typed revocation failures.
+
+## 0.6.1 - 2026-10-30
+
+### Changed
+
+- Release with updated workspace dependencies.
+
+## 0.6.0 - 2026-10-30
+
+### Added
+
+- `@shivaedev/server`: Configure a direct or session-mode change listener with `config.listenDatabaseUrl` or `LISTEN_DATABASE_URL`, falling back to the application connection when unset.
+- `@shivaedev/sql`: Supply `listenerClient` separately from the writing `client` to `postgresChanges`; set `connectionSetting` to identify that connection in diagnostics.
+- `@shivaedev/sql/postgresLayer.ts` provides `postgresLayer(url, options)` with one native `PgPool` shared by `PgClient` and `SqlClient`. Reserved connections and client queries share `maxConnections`, and Layer shutdown waits for every socket to close.
+- `appDatabase` and database-backed `appHost` expose the application's native `PgPool` service for packages that need reserved PostgreSQL connections.
+
+### Fixed
+
+- A denied per-hint session or query policy recheck ends the hosted live subscription with `QueryReadDenied` instead of silently dropping the hint. Custom consumers must handle this declared failure; automatic bound queries rerun their authorized read so the screen can show the denial.
+- Retry worker-release heartbeat and poll failures on a bounded schedule, log their causes, and close the worker scope with the original cause when recovery fails. Heartbeats continue while jobs drain after a connection blip.
+- Log change-listener loss and reconnect causes, and bound listener sub-scope cleanup without rewriting scope finalizers.
+- Fail application database startup when its first PostgreSQL LISTEN or heartbeat fails, instead of waiting indefinitely.
+- SQL decodes migration ledger, release ownership and change-coverage rows before using them. Malformed rows fail with `SchemaError` instead of being treated as current, pending or a different owner.
+- SQL generates worker identities and change-listener heartbeat tokens through Effect's `Random` service.
+
+### Breaking
+
+- Listener startup deadlines now fail with `PostgresListenerError`, naming the connection setting, instead of `SqlError`. Consumers handling startup failures must also handle `PostgresListenerError` from `@shivaedev/sql/PostgresListenerError.ts`. Hosts using transaction-pooled application URLs must set `LISTEN_DATABASE_URL` or `config.listenDatabaseUrl` to a direct or session-mode connection to the same database. Native SQL startup failures still use `SqlError`.
+- Server's PostgreSQL construction and address helpers move to sql. Consumers of `@shivaedev/server/adapters/postgresClient.ts` must compose `postgresLayer` from `@shivaedev/sql/postgresLayer.ts` and read the native `PgPool` or `PgClient` service instead. Address-only consumers import `databaseAddress` from `@shivaedev/sql/databaseAddress.ts` instead of `@shivaedev/server/databaseAddress.ts`.
+- `postgresChanges` and `listenForChanges` now expose `SqlError` during acquisition. Consumers that required an infallible Layer or Effect must handle or propagate this error. `heartbeatTimeout` bounds the first LISTEN acquisition and its first heartbeat; retry startup at the application boundary if desired. Established listeners continue to reconnect.
+- Schema component failures now reach SQL migration and readiness callers, server startup and test-sql migration helpers with their original error, tag and cause, and log the component name. Handle the component's own error instead of a wrapping `MigrationError` with kind `Failed`. When annotating migration options with fallible components, supply their error type as the second generic parameter; the default describes components that cannot fail.
+- Declare `WorkerRelease` through `defineService`. Consumers using the old class as a type must use `Context.Service.Identifier<typeof WorkerRelease>`; yielding the service and providing its value stay the same.
+
+## 0.5.0 - 2026-10-30
+
+### Changed
+
+- Require Effect 4.0.6 and align the Effect companion package peers and generated starter catalog to the same exact release. Install the 4.0.6 Effect stack together.
+- The starter's Railway deployment supplies `TRUSTED_PROXY=100.64.0.0/10` and `AUTH_CLIENT_IP_HEADER=x-real-ip` through its shared proxy configuration. Generated deployment docs explain the automatic Railway settings and when a host refuses to boot.
+
+### Fixed
+
+- Register hosted RPC cache-control handling through Effect 4.0.6's request-scoped pre-response API so responses keep `private, no-store`.
+- Accept native RPC's `application/x-ndjson` media type while preserving `application/ndjson` callers at the transport guard.
+- Keep subscriptions open after their HTTP request body completes; closing the socket still cancels them.
+
+### Breaking
+
+- `@shivaedev/server` refuses to start a session host bound to a non-loopback address without proxy trust, with a typed `TrustedProxyRequired` error naming the missing setting. Set `TRUSTED_PROXY` to your proxy's peer IP addresses or CIDR ranges, set `config.trustedProxy`, or deploy with the starter's Railway configuration. Local loopback hosts keep working without it.
+
+## 0.4.0 - 2026-10-29
+
+### Added
+
+- Forwarding proxy fixtures relay WebSocket upgrades, including the same origin and trusted proxy headers as HTTP requests. Existing proxy URLs also work for socket clients.
+
+### Fixed
+
+- Revoked bearer and cookie change subscriptions end with typed `Unauthorized` from session middleware, without racing a host-initiated socket close. Later protected calls on the shared socket reject the revoked session.
+
+### Breaking
+
+- Contract clients use Effect RPC over a shared WebSocket by default. Replace `httpClient`, `transformClient` and `serialization` client options with a native `protocol` Layer for custom transports. Node clients can supply upgrade `headers` and a `webSocketConstructor` Layer; browsers use their session cookie automatically.
+- Mounting a bound query subscribes before its first authorized read; unmounting releases its subscription. Use `live: false` when binding an ordinary client without subscriptions. Query preparation alone no longer opens a change stream.
+- Hosts serve live subscriptions on the WebSocket upgrade at the RPC path. Move HTTP `$changes` consumers to Effect RPC's socket protocol; the POST route serves ordinary RPC only. Configure development proxies to forward WebSocket upgrades.
+- React session boundaries bind shared sockets to the identified session, so replacing an account upgrades with its current cookie. They also ask the auth owner to recheck when the live socket closes. Keep `recheck` safe to call after a network interruption; the auth owner still decides whether the session ends.
+
+## 0.3.1 - 2026-10-29
+
+### Fixed
+
+- The application host constructs services, handlers and routes before listening, so startup connections are refused until requests can be answered.
+- Server and HTTP modules import Node platform modules directly to avoid loading Redis during startup.
+- Generated apps import Node platform modules directly, and deployment stories allow enough time for their sequential cold processes without a fixed timeout on each startup health probe.
+
+## 0.3.0 - 2026-10-28
+
+### Added
+
+- Application HTTP routes registered through `appHost.routes` can use app services, with route construction errors and missing dependencies retained in the host's types. Generated apps register HTTP routes and static assets through this option.
+- Application routes can answer foreign-origin preflights through native `HttpMiddleware.cors`. Host origin restrictions cover the configured RPC path and `/api/auth/*`, including `/api/auth`; other foreign origins still receive 403 there.
+- Declare collection policies beside module contracts with `ModuleReadPolicies` and combine them with `mergeReadPolicies`. Unclaimed collections are denied. Each policy receives the request's optional viewer.
+- The application host accepts a merged `readPolicy` and checks queries and live hints inside native session middleware, using its resolved identity without another session lookup. Policies can use application services and return `Forbidden` or `AuthUnavailable`.
+- Query authorization and live-hint filtering check keys concurrently so native `Effect.request` resolvers can batch membership checks. Plain Effect policies remain supported.
+- The application host provides Effect's native Crypto service during preflight and deferred construction as well as in application handlers, so commands can generate secure invite codes without ambient randomness.
+- Story kits provide native TestCrypto with a fresh seed of 0 for each story, making generated invite codes reproducible. The application’s @effect/platform-node peer supplies its digest implementation.
+- Ambient-randomness findings name Effect's Crypto service for secure values and Random for non-secure values.
+
+### Fixed
+
+- Enforce declared query read policies at the hosted RPC handler boundary, including contracts without identity middleware, whose viewer is anonymous. Query RPC error schemas include `QueryReadDenied` so native clients receive typed refusals before handlers run.
+- Keep collection methods and untyped schema internals from making data parameters appear to carry callable services. Direct service implementations, nested dependency fields and service arrays remain subject to `effect/service-parameters`.
+
+### Breaking
+
+- Move key imports from `@shivaedev/contract/keys.ts` to `@shivaedev/changes/keys.ts`. Declare bucket fields with `collection(name, idSchema, fields)` and publish affected buckets alongside record keys.
+- Replace collection policy maps, `mergeReadPolicies`, `ReadPolicy` and `ReadPolicyMemoWindow` with each query's `readPolicy(payload, viewer)`. Declare the same query's live scope with `reads(payload, viewer)`. Bound query atoms and subscriptions refuse missing policies with a declaration error; one-off query `run` calls remain available. Denied queries refuse the entire subscription. Server adapters replace `QueryReads` and `ChangesReads` with `QueryDefinition` and `ChangesQueries`. Custom middleware calls `authorizeReads(effect, request, viewer)` and declares `MissingReadPolicy` and `QueryReadDenied` errors.
+- Custom subscription adapters yield `ChangesQueries.resolve(references)`, call `querySubscription(requests, viewer)` and pass the authorized result to `makeLiveServer.subscribe(subscription, context)`. Metadata values expose `QueryDefinition.definition` and `CommandInvalidation.invalidates` instead of bare definitions and callbacks. Yield the Effect returned by `queryKeys(queries, references)` when projecting keys for a custom stream. `resolveChanges` supplies the authorized subscription in hosted applications. Changed hints can carry query positions so bindings can rerun session-scoped reads without deriving session scopes in the browser.
+- Remove `appHost`'s `readPolicy` option and module policy registration. Session and permission middleware apply query policies using the current session viewer. Handle the new typed policy errors in native clients, including `QueryReadDenied` on query RPCs without identity middleware; widen explicit query error annotations accordingly.
+- Replace `sessionCommandChanges` with `commandChanges` for custom session middleware. Command invalidation callbacks can receive the session viewer as their third argument. Announce viewer buckets there; background writers must explicitly publish those bucket keys after commit.
+- Built-in admin queries declare their permission policies alongside their schemas and read scopes. Consumers keep supplying the existing session and permission middleware layers.
+- Local Work Board and Fleet queries declare their existing loopback read access explicitly so their generated live subscriptions remain available.
+- `authorizeReads` now takes `(effect, request, policy, viewer, denied)`, and policies take `(key, viewer)`. Pass `Option.some(resolvedIdentity)` or `Option.none()` before the denial effect. Existing unary policy functions may ignore the new viewer argument. Apps using `appHost` can replace custom read middleware with its `readPolicy` option and merge their modules' policy maps.
+
+## 0.2.0 - 2026-10-27
+
+### Added
+
+- Session hosts bound to a non-loopback address without proxy trust warn at startup to configure `TRUSTED_PROXY` or `config.trustedProxy` before forwarding RPC requests.
+
+### Fixed
+
+- Development auth accepts both `localhost` and `127.0.0.1` over HTTP on any port when `PUBLIC_URL` is unset. Explicit `baseURL` and `trustedOrigins` options replace those defaults.
+- Auth rate limiting uses the connection peer address without a trusted proxy, separating client buckets and avoiding Better Auth's missing-client-IP warning. Trusted forwarding still takes precedence, and untrusted forwarding headers are ignored.
+- Supply the host's body-size limit to application routes, so bounded body readers enforce the same limit as RPC.
+
+## 0.1.0 - 2026-10-27
+
+### Added
+
+- First release of `@shivaedev/server`, the application host extracted from `@shivaedev/platform`: `appHost`, the database layer and migrations, health, OTLP export, the redacting tracer and RPC serialization, development mode, the Promise runtime (`runtime/`) and Node subscription signals (`node-http/`). Modules sit at the package root, so `@shivaedev/platform/server/appHost.ts` becomes `@shivaedev/server/appHost.ts`. The `AppChanges` and `RedactionPolicy` service ids now name the package.

package/dist/RedactionPolicy.d.ts

@@ -1,4 +1,8 @@
 import { Context } from "effect";
 import { type SensitiveKey } from "@shivaedev/errors/sensitive.ts";
-export declare const RedactionPolicy: Context.Reference<SensitiveKey>;
+export interface HostRedactionPolicy extends SensitiveKey {
+    readonly forRpc?: (tag: string | undefined) => SensitiveKey;
+}
+export declare function redactionForRpc(policy: HostRedactionPolicy, tag: unknown): SensitiveKey;
+export declare const RedactionPolicy: Context.Reference<HostRedactionPolicy>;
 //# sourceMappingURL=RedactionPolicy.d.ts.map

package/dist/RedactionPolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RedactionPolicy.d.ts","sourceRoot":"","sources":["../src/RedactionPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAEnF,eAAO,MAAM,eAAe,iCAA+G,CAAC"}
+{"version":3,"file":"RedactionPolicy.d.ts","sourceRoot":"","sources":["../src/RedactionPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAEnF,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACxD,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,KAAK,YAAY,CAAC;CAC5D;AACD,wBAAgB,eAAe,CAAC,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,OAAO,GAAG,YAAY,CAEvF;AACD,eAAO,MAAM,eAAe,wCAAsH,CAAC"}

package/dist/RedactionPolicy.js

@@ -1,4 +1,7 @@
 import { Context } from "effect";
 import { isSensitiveKey } from "@shivaedev/errors/sensitive.ts";
+export function redactionForRpc(policy, tag) {
+    return policy.forRpc?.(typeof tag === "string" ? tag : undefined) ?? policy;
+}
 export const RedactionPolicy = Context.Reference("@shivaedev/server/RedactionPolicy", { defaultValue: () => isSensitiveKey });
 //# sourceMappingURL=RedactionPolicy.js.map

package/dist/RedactionPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"RedactionPolicy.js","sourceRoot":"","sources":["../src/RedactionPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,cAAc,EAAqB,MAAM,gCAAgC,CAAC;AAEnF,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,CAAe,mCAAmC,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC"}
+{"version":3,"file":"RedactionPolicy.js","sourceRoot":"","sources":["../src/RedactionPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,cAAc,EAAqB,MAAM,gCAAgC,CAAC;AAKnF,MAAM,UAAU,eAAe,CAAC,MAA2B,EAAE,GAAY;IACxE,OAAO,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC;AAC7E,CAAC;AACD,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,CAAsB,mCAAmC,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC"}

package/dist/hostChanges.js

@@ -47,7 +47,7 @@ function authorizeSession(sessions, tag, viewer, policy) {
     if (sessions === undefined) {
         return policy;
     }
-    return recheckSession(sessions, Headers.empty, tag).pipe(Effect.map((current) => Option.isNone(viewer) || (Option.isSome(current) && current.value.user.id === viewer.value.id)), Effect.catch(() => Effect.succeed(false)), Effect.flatMap((allowed) => (allowed ? policy : Effect.succeed(false))));
+    return recheckSession(sessions, Headers.empty, tag).pipe(Effect.map((current) => Option.isNone(viewer) || (Option.isSome(current) && current.value.user.id === viewer.value.id)), Effect.flatMap((allowed) => allowed ? policy : Effect.fail(new Unauthorized({ message: "Authentication required" }))));
 }
 function sessionRevoked(sessions, tag, id) {
     return Effect.gen(function* () {

package/dist/hostChanges.js.map

@@ -1 +1 @@
-{"version":3,"file":"hostChanges.js","sourceRoot":"","sources":["../src/hostChanges.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,aAAa,EAAe,MAAM,mCAAmC,CAAC;AAE/E,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAE9E,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AAEhF,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,MAAM,UAAU,WAAW,CAC1B,KAA2B,EAC3B,cAAiC,EACjC,QAAkC;IAElC,OAAO,KAAK,CAAC,aAAa,CACzB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;QAC5C,SAAS,SAAS,CAAC,GAAY,EAAE,OAAkC,EAAE,OAAsD;YAC1H,OAAO,MAAM,CAAC,MAAM,CACnB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACnB,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBACtE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;gBACpC,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;gBACzF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;oBACpC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;oBAC/F,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAW,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5E,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBACrD,OAAO,MAAM,CAAC;gBACf,CAAC;gBACD,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1F,CAAC,CAAC,CACF,CAAC;QACH,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrC,SAAS;YACV,CAAC;YACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACtD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAChC,SAAS;YACV,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE;gBACrB,OAAO,EAAE,QAAQ;gBACjB,OAAO,EAAE,CAAC,EAAE,OAAO,EAAmD,EAAE,OAAsD,EAAE,EAAE,CACjI,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC;gBACjC,GAAG,EAAE,GAAG,CAAC,IAAI;aACb,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC,UAAU,CAAqE,QAAQ,CAAC,CAAC;IACzG,CAAC,CAAC,CACF,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACxB,QAA6C,EAC7C,GAAW,EACX,MAA6B,EAC7B,MAAoC;IAEpC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC;IACf,CAAC;IACD,OAAO,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CACvD,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EACvH,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EACzC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CACvE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAgC,QAAiC,EAAE,GAAW,EAAE,EAAU;IAChH,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC9I,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACvF,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACxE,CAAC;IACF,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,0BAA0B,IAAI,YAAY,CAAC,CAAC,CAAC;AACnG,CAAC"}
+{"version":3,"file":"hostChanges.js","sourceRoot":"","sources":["../src/hostChanges.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,aAAa,EAAe,MAAM,mCAAmC,CAAC;AAE/E,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAE9E,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AAEhF,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,MAAM,UAAU,WAAW,CAC1B,KAA2B,EAC3B,cAAiC,EACjC,QAAkC;IAElC,OAAO,KAAK,CAAC,aAAa,CACzB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;QAC5C,SAAS,SAAS,CAAC,GAAY,EAAE,OAAkC,EAAE,OAAsD;YAC1H,OAAO,MAAM,CAAC,MAAM,CACnB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACnB,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBACtE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;gBACpC,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;gBACzF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;oBACpC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;oBAC/F,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAW,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5E,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBACrD,OAAO,MAAM,CAAC;gBACf,CAAC;gBACD,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1F,CAAC,CAAC,CACF,CAAC;QACH,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrC,SAAS;YACV,CAAC;YACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACtD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAChC,SAAS;YACV,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE;gBACrB,OAAO,EAAE,QAAQ;gBACjB,OAAO,EAAE,CAAC,EAAE,OAAO,EAAmD,EAAE,OAAsD,EAAE,EAAE,CACjI,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC;gBACjC,GAAG,EAAE,GAAG,CAAC,IAAI;aACb,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC,UAAU,CAAqE,QAAQ,CAAC,CAAC;IACzG,CAAC,CAAC,CACF,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACxB,QAA6C,EAC7C,GAAW,EACX,MAA6B,EAC7B,MAAoC;IAEpC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC;IACf,CAAC;IACD,OAAO,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CACvD,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EACvH,MAAM,CAAC,OAAO,CACb,CAAC,OAAO,EAA+C,EAAE,CACxD,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC,CACzF,CACD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAgC,QAAiC,EAAE,GAAW,EAAE,EAAU;IAChH,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC9I,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACvF,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACxE,CAAC;IACF,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,0BAA0B,IAAI,YAAY,CAAC,CAAC,CAAC;AACnG,CAAC"}

package/dist/hostRpcRoutes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hostRpcRoutes.d.ts","sourceRoot":"","sources":["../src/hostRpcRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAmC,UAAU,EAAyC,MAAM,aAAa,CAAC;AAEjH,OAAO,EAAE,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,KAAK,EAAqC,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAE3G,OAAO,EAA+C,KAAK,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAEvH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAGnE,wBAAgB,aAAa,CAAC,KAAK,SAAS,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,SAAS,YAAY,EACnH,OAAO,EAAE;IACR,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IACjE,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC;CACxC,GAAG,UAAU,CAAC,QAAQ,CAAC,EACxB,cAAc,EAAE,OAAO,UAAU,EACjC,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,EAC3F,SAAS,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC;;;;;;;;0CA6CjD"}
+{"version":3,"file":"hostRpcRoutes.d.ts","sourceRoot":"","sources":["../src/hostRpcRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAmC,UAAU,EAAyC,MAAM,aAAa,CAAC;AAEjH,OAAO,EAAE,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,KAAK,EAAqC,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAE3G,OAAO,EAA+C,KAAK,YAAY,EAAE,MAAM,uCAAuC,CAAC;AACvH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAGnE,wBAAgB,aAAa,CAAC,KAAK,SAAS,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,SAAS,YAAY,EACnH,OAAO,EAAE;IACR,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IACjE,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC;CACxC,GAAG,UAAU,CAAC,QAAQ,CAAC,EACxB,cAAc,EAAE,OAAO,UAAU,EACjC,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,EAC3F,SAAS,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC;;;;;;;;0CA6CjD"}

package/dist/hostRpcRoutes.js

@@ -4,18 +4,18 @@ import * as HttpStatus from "effect/http/HttpStatus";
 import { RpcSerialization } from "effect/rpc";
 import { localRpcGuard } from "@shivaedev/identity/server/local.ts";
 import { authenticatedLayer, maybeAuthenticatedLayer } from "@shivaedev/identity/server/session.ts";
-import { requestTracingLayer } from "@shivaedev/identity/server/tracing.ts";
 import { boundedRpcRequest } from "#boundedRpcRequest.ts";
 import { hostChanges } from "#hostChanges.ts";
 import { hostRpc, rpcCacheControl } from "#hostRpc.ts";
 import { redactingRpcSerialization } from "#redactingRpcSerialization.ts";
+import { rpcRequestTracing } from "#rpcRequestTracing.ts";
 import { socketRpc } from "#socketRpc.ts";
 export function hostRpcRoutes(options, changesService, { bodySize, trustedProxy, nativeOrigins }, sensitive) {
     const middleware = options.policy === "loopback"
-        ? requestTracingLayer({ sensitive })
-        : Layer.mergeAll(authenticatedLayer(options.sessions), maybeAuthenticatedLayer(options.sessions), requestTracingLayer({ sensitive }));
+        ? rpcRequestTracing(sensitive)
+        : Layer.mergeAll(authenticatedLayer(options.sessions), maybeAuthenticatedLayer(options.sessions), rpcRequestTracing(sensitive));
     return HttpRouter.use((router) => Effect.gen(function* () {
-        const wire = redactingRpcSerialization(yield* RpcSerialization.RpcSerialization, sensitive, sensitive.maskFailure);
+        const wire = redactingRpcSerialization(yield* RpcSerialization.RpcSerialization, sensitive, sensitive.maskFailure, sensitive.forRpc);
         const httpGroup = options.group.omit(...[...options.group.requests.keys()].filter((tag) => tag.endsWith(".$changes")));
         const handler = yield* hostRpc(httpGroup).pipe(Effect.provideService(RpcSerialization.RpcSerialization, wire));
         const guarded = localRpcGuard(handler, trustedProxy, nativeOrigins);

package/dist/hostRpcRoutes.js.map

@@ -1 +1 @@
-{"version":3,"file":"hostRpcRoutes.js","sourceRoot":"","sources":["../src/hostRpcRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjH,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAA2B,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEvE,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAqB,MAAM,uCAAuC,CAAC;AACvH,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAE5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE1C,MAAM,UAAU,aAAa,CAC5B,OAIwB,EACxB,cAAiC,EACjC,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAoD,EAC3F,SAAiD;IAEjD,MAAM,UAAU,GACf,OAAO,CAAC,MAAM,KAAK,UAAU;QAC5B,CAAC,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,CAAC;QACpC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,uBAAuB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACxI,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAChC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;QACnH,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACvH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/G,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3H,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAChB,SAAS,EACT,OAAO,CAAC,OAAO,IAAI,MAAM,EACzB,kBAAkB,CAAC,IAAI,CAAC,iCAAiC,EAAE;YAC1D,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC;SAC3C,CAAC,CACF,CAAC;QACF,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAChB,KAAK,EACL,OAAO,CAAC,OAAO,IAAI,MAAM,EACzB,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAC/H,CAAC;QACF,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAChE,OAAO,CAAC,IAAI,CACX,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAChF,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,EACtF,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,CAAC,EAC9D,UAAU,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAClD,CACD,CAAC;IACH,CAAC,CAAC,CACF,CAAC,IAAI,CACL,KAAK,CAAC,OAAO,CACZ,KAAK,CAAC,KAAK,CACV,UAAU,EACV,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC5G,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CACpC,CACD,CACD,EACD,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAC3C,CAAC;AACH,CAAC"}
+{"version":3,"file":"hostRpcRoutes.js","sourceRoot":"","sources":["../src/hostRpcRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjH,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAA2B,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEvE,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAqB,MAAM,uCAAuC,CAAC;AAEvH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE1C,MAAM,UAAU,aAAa,CAC5B,OAIwB,EACxB,cAAiC,EACjC,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAoD,EAC3F,SAAiD;IAEjD,MAAM,UAAU,GACf,OAAO,CAAC,MAAM,KAAK,UAAU;QAC5B,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC;QAC9B,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,uBAAuB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;IAClI,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAChC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QACrI,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACvH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/G,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3H,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAChB,SAAS,EACT,OAAO,CAAC,OAAO,IAAI,MAAM,EACzB,kBAAkB,CAAC,IAAI,CAAC,iCAAiC,EAAE;YAC1D,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC;SAC3C,CAAC,CACF,CAAC;QACF,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAChB,KAAK,EACL,OAAO,CAAC,OAAO,IAAI,MAAM,EACzB,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAC/H,CAAC;QACF,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAChE,OAAO,CAAC,IAAI,CACX,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAChF,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,EACtF,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,CAAC,EAC9D,UAAU,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAClD,CACD,CAAC;IACH,CAAC,CAAC,CACF,CAAC,IAAI,CACL,KAAK,CAAC,OAAO,CACZ,KAAK,CAAC,KAAK,CACV,UAAU,EACV,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC5G,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CACpC,CACD,CACD,EACD,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAC3C,CAAC;AACH,CAAC"}

package/dist/redactingDiagnostics.d.ts

@@ -1,5 +1,6 @@
 import { Layer } from "effect";
 import type { SensitiveKey } from "@shivaedev/errors/sensitive.ts";
+import { type HostRedactionPolicy } from "#RedactionPolicy.ts";
 export declare function redactRecord(values: Readonly<Record<string, unknown>>, sensitive: SensitiveKey): Record<string, unknown>;
-export declare function redactingDiagnostics(sensitive: SensitiveKey): Layer.Layer<never, never, never>;
+export declare function redactingDiagnostics(policy: HostRedactionPolicy): Layer.Layer<never, never, never>;
 //# sourceMappingURL=redactingDiagnostics.d.ts.map

package/dist/redactingDiagnostics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redactingDiagnostics.d.ts","sourceRoot":"","sources":["../src/redactingDiagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkC,KAAK,EAAsB,MAAM,QAAQ,CAAC;AAGnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAEnE,wBAAgB,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAExH;AACD,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,YAAY,oCAwB3D"}
+{"version":3,"file":"redactingDiagnostics.d.ts","sourceRoot":"","sources":["../src/redactingDiagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkC,KAAK,EAAsB,MAAM,QAAQ,CAAC;AAGnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,KAAK,mBAAmB,EAAmB,MAAM,qBAAqB,CAAC;AAEhF,wBAAgB,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAExH;AAUD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,mBAAmB,oCA0B/D"}

package/dist/redactingDiagnostics.js

@@ -1,16 +1,28 @@
 import { Context, Effect, ErrorReporter, Layer, Logger, References } from "effect";
 import { redact } from "@shivaedev/errors/redact.ts";
 import { redactDiagnosticCause, redactingErrorReporter } from "@shivaedev/errors/redactCause.ts";
+import { redactionForRpc } from "#RedactionPolicy.ts";
 export function redactRecord(values, sensitive) {
     return Object.fromEntries(Object.entries(values).map(([key, value]) => [key, sensitive(key) ? "<redacted>" : redact(value, sensitive)]));
 }
-export function redactingDiagnostics(sensitive) {
+function requestErrorReporter(reporter, policy) {
+    return {
+        [ErrorReporter.TypeId]: ErrorReporter.TypeId,
+        report: (options) => {
+            const sensitive = redactionForRpc(policy, options.fiber.getRef(References.CurrentLogAnnotations)["rpc.method"]);
+            return redactingErrorReporter(reporter, sensitive).report(options);
+        },
+    };
+}
+export function redactingDiagnostics(policy) {
     return Layer.effectContext(Effect.gen(function* () {
         const loggers = yield* Logger.CurrentLoggers;
         const reporters = yield* ErrorReporter.CurrentErrorReporters;
         const safeLoggers = new Set([...loggers].map((logger) => Logger.make((options) => {
             const context = options.fiber.context;
-            const annotations = redactRecord(options.fiber.getRef(References.CurrentLogAnnotations), sensitive);
+            const raw = options.fiber.getRef(References.CurrentLogAnnotations);
+            const sensitive = redactionForRpc(policy, raw["rpc.method"]);
+            const annotations = redactRecord(raw, sensitive);
             options.fiber.setContext(Context.add(context, References.CurrentLogAnnotations, annotations));
             try {
                 return logger.log({ ...options, cause: redactDiagnosticCause(options.cause, sensitive), message: redact(options.message, sensitive) });
@@ -19,7 +31,7 @@ export function redactingDiagnostics(sensitive) {
                 options.fiber.setContext(context);
             }
         })));
-        return Context.make(Logger.CurrentLoggers, safeLoggers).pipe(Context.add(ErrorReporter.CurrentErrorReporters, new Set([...reporters].map((reporter) => redactingErrorReporter(reporter, sensitive)))));
+        return Context.make(Logger.CurrentLoggers, safeLoggers).pipe(Context.add(ErrorReporter.CurrentErrorReporters, new Set([...reporters].map((reporter) => requestErrorReporter(reporter, policy)))));
     }));
 }
 //# sourceMappingURL=redactingDiagnostics.js.map

package/dist/redactingDiagnostics.js.map

@@ -1 +1 @@
-{"version":3,"file":"redactingDiagnostics.js","sourceRoot":"","sources":["../src/redactingDiagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAGjG,MAAM,UAAU,YAAY,CAAC,MAAyC,EAAE,SAAuB;IAC9F,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1I,CAAC;AACD,MAAM,UAAU,oBAAoB,CAAC,SAAuB;IAC3D,OAAO,KAAK,CAAC,aAAa,CACzB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC;QAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,qBAAqB,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAI,GAAG,CAC1B,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC3B,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YACvB,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YACtC,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,SAAS,CAAC,CAAC;YACpG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC,CAAC;YAC9F,IAAI,CAAC;gBACJ,OAAO,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,qBAAqB,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;YACxI,CAAC;oBAAS,CAAC;gBACV,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACnC,CAAC;QACF,CAAC,CAAC,CACF,CACD,CAAC;QACF,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,IAAI,CAC3D,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,qBAAqB,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CACxI,CAAC;IACH,CAAC,CAAC,CACF,CAAC;AACH,CAAC"}
+{"version":3,"file":"redactingDiagnostics.js","sourceRoot":"","sources":["../src/redactingDiagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAEjG,OAAO,EAA4B,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEhF,MAAM,UAAU,YAAY,CAAC,MAAyC,EAAE,SAAuB;IAC9F,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1I,CAAC;AACD,SAAS,oBAAoB,CAAC,QAAqC,EAAE,MAA2B;IAC/F,OAAO;QACN,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM;QAC5C,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YACnB,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;YAChH,OAAO,sBAAsB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;KACD,CAAC;AACH,CAAC;AACD,MAAM,UAAU,oBAAoB,CAAC,MAA2B;IAC/D,OAAO,KAAK,CAAC,aAAa,CACzB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC;QAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,qBAAqB,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAI,GAAG,CAC1B,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC3B,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YACvB,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YACtC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;YACnE,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;YAC7D,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACjD,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC,CAAC;YAC9F,IAAI,CAAC;gBACJ,OAAO,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,qBAAqB,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;YACxI,CAAC;oBAAS,CAAC;gBACV,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACnC,CAAC;QACF,CAAC,CAAC,CACF,CACD,CAAC;QACF,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,IAAI,CAC3D,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,qBAAqB,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CACnI,CAAC;IACH,CAAC,CAAC,CACF,CAAC;AACH,CAAC"}

package/dist/redactingRpcSerialization.d.ts

@@ -1,4 +1,4 @@
 import type { RpcSerialization } from "effect/rpc";
 import { type SensitiveKey } from "@shivaedev/errors/sensitive.ts";
-export declare function redactingRpcSerialization(wire: RpcSerialization.RpcSerialization["Service"], sensitive: SensitiveKey, maskFailure?: (tag: string | undefined, reason: "Fail" | "Die") => boolean): typeof wire;
+export declare function redactingRpcSerialization(wire: RpcSerialization.RpcSerialization["Service"], sensitive: SensitiveKey, maskFailure?: (tag: string | undefined, reason: "Fail" | "Die") => boolean, sensitiveForRpc?: (tag: string | undefined) => SensitiveKey): typeof wire;
 //# sourceMappingURL=redactingRpcSerialization.d.ts.map

package/dist/redactingRpcSerialization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redactingRpcSerialization.d.ts","sourceRoot":"","sources":["../src/redactingRpcSerialization.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,OAAO,EAAY,KAAK,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAK7E,wBAAgB,yBAAyB,CACxC,IAAI,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAClD,SAAS,EAAE,YAAY,EACvB,WAAW,GAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,KAAK,KAAK,OAAqB,GACrF,OAAO,IAAI,CAwEb"}
+{"version":3,"file":"redactingRpcSerialization.d.ts","sourceRoot":"","sources":["../src/redactingRpcSerialization.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,OAAO,EAAY,KAAK,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAK7E,wBAAgB,yBAAyB,CACxC,IAAI,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAClD,SAAS,EAAE,YAAY,EACvB,WAAW,GAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,KAAK,KAAK,OAAqB,EACvF,eAAe,GAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,KAAK,YAA8B,GAC1E,OAAO,IAAI,CAwEb"}

package/dist/redactingRpcSerialization.js

@@ -4,9 +4,9 @@ import { REDACTED } from "@shivaedev/errors/sensitive.ts";
 function isRequestId(value) {
     return typeof value === "string" || typeof value === "number";
 }
-export function redactingRpcSerialization(wire, sensitive, maskFailure = () => false) {
+export function redactingRpcSerialization(wire, sensitive, maskFailure = () => false, sensitiveForRpc = () => sensitive) {
     function reason(value, tag) {
-        const redacted = redactWire(value, sensitive);
+        const redacted = redactWire(value, sensitiveForRpc(tag));
         if (Predicate.isObjectOrArray(redacted)) {
             if (Predicate.isTagged(value, "Fail") && maskFailure(tag, "Fail")) {
                 return { ...redacted, _tag: "Fail", error: REDACTED };
@@ -23,7 +23,7 @@ export function redactingRpcSerialization(wire, sensitive, maskFailure = () => f
     }
     function exit(value, tag) {
         if (Predicate.isTagged(value, "Failure") && Predicate.hasProperty(value, "cause")) {
-            const cause = Array.isArray(value.cause) ? value.cause.map((item) => reason(item, tag)) : redactWire(value.cause, sensitive);
+            const cause = Array.isArray(value.cause) ? value.cause.map((item) => reason(item, tag)) : redactWire(value.cause, sensitiveForRpc(tag));
             return { ...value, cause };
         }
         return value;

package/dist/redactingRpcSerialization.js.map

@@ -1 +1 @@
-{"version":3,"file":"redactingRpcSerialization.js","sourceRoot":"","sources":["../src/redactingRpcSerialization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAEnC,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAqB,MAAM,gCAAgC,CAAC;AAE7E,SAAS,WAAW,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AAC/D,CAAC;AACD,MAAM,UAAU,yBAAyB,CACxC,IAAkD,EAClD,SAAuB,EACvB,WAAW,GAAiE,GAAG,EAAE,CAAC,KAAK;IAEvF,SAAS,MAAM,CAAC,KAAc,EAAE,GAAuB;QACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC9C,IAAI,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;gBACnE,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;YACvD,CAAC;YACD,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;gBACjE,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YACvD,CAAC;QACF,CAAC;QACD,IACC,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;eAC9G,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,EACrC,CAAC;YACF,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,SAAS,IAAI,CAAC,KAAc,EAAE,GAAuB;QACpD,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YACnF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC7H,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO;QACN,GAAG,IAAI;QACP,UAAU,EAAE,GAAG,EAAE;YAChB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;YACpD,SAAS,QAAQ,CAAC,KAAc;gBAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1B,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC5B,CAAC;gBACD,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;oBACnF,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC7G,CAAC;gBACD,IACC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;uBAC9B,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC;uBACzC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC;uBAC5B,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,EACtC,CAAC;oBACF,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBAC1C,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBACjC,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBAClD,CAAC;gBACD,OAAO,KAAK,CAAC;YACd,CAAC;YACD,OAAO;gBACN,GAAG,MAAM;gBACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;oBAChB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBACpC,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;wBAC/B,IACC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;+BACnC,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC;+BACpC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;+BACvB,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC;+BACrC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;+BAC/B,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAC3B,CAAC;4BACF,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;wBACvC,CAAC;oBACF,CAAC;oBACD,OAAO,OAAO,CAAC;gBAChB,CAAC;gBACD,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;aACjD,CAAC;QACH,CAAC;KACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"redactingRpcSerialization.js","sourceRoot":"","sources":["../src/redactingRpcSerialization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAEnC,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAqB,MAAM,gCAAgC,CAAC;AAE7E,SAAS,WAAW,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AAC/D,CAAC;AACD,MAAM,UAAU,yBAAyB,CACxC,IAAkD,EAClD,SAAuB,EACvB,WAAW,GAAiE,GAAG,EAAE,CAAC,KAAK,EACvF,eAAe,GAA8C,GAAG,EAAE,CAAC,SAAS;IAE5E,SAAS,MAAM,CAAC,KAAc,EAAE,GAAuB;QACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QACzD,IAAI,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;gBACnE,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;YACvD,CAAC;YACD,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;gBACjE,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YACvD,CAAC;QACF,CAAC;QACD,IACC,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;eAC9G,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,EACrC,CAAC;YACF,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,SAAS,IAAI,CAAC,KAAc,EAAE,GAAuB;QACpD,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YACnF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;YACxI,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO;QACN,GAAG,IAAI;QACP,UAAU,EAAE,GAAG,EAAE;YAChB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;YACpD,SAAS,QAAQ,CAAC,KAAc;gBAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1B,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC5B,CAAC;gBACD,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;oBACnF,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC7G,CAAC;gBACD,IACC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;uBAC9B,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC;uBACzC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC;uBAC5B,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,EACtC,CAAC;oBACF,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBAC1C,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBACjC,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBAClD,CAAC;gBACD,OAAO,KAAK,CAAC;YACd,CAAC;YACD,OAAO;gBACN,GAAG,MAAM;gBACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;oBAChB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBACpC,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;wBAC/B,IACC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;+BACnC,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC;+BACpC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;+BACvB,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC;+BACrC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;+BAC/B,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAC3B,CAAC;4BACF,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;wBACvC,CAAC;oBACF,CAAC;oBACD,OAAO,OAAO,CAAC;gBAChB,CAAC;gBACD,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;aACjD,CAAC;QACH,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/redactingTracer.d.ts

@@ -1,4 +1,4 @@
 import { Layer } from "effect";
-import { type SensitiveKey } from "@shivaedev/errors/sensitive.ts";
-export declare function redactingTracer(sensitive: SensitiveKey): Layer.Layer<never, never, never>;
+import { type HostRedactionPolicy } from "#RedactionPolicy.ts";
+export declare function redactingTracer(sensitive: HostRedactionPolicy): Layer.Layer<never, never, never>;
 //# sourceMappingURL=redactingTracer.d.ts.map

package/dist/redactingTracer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redactingTracer.d.ts","sourceRoot":"","sources":["../src/redactingTracer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,EAAU,MAAM,QAAQ,CAAC;AAGrD,OAAO,EAAY,KAAK,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAuB7E,wBAAgB,eAAe,CAAC,SAAS,EAAE,YAAY,oCAUtD"}
+{"version":3,"file":"redactingTracer.d.ts","sourceRoot":"","sources":["../src/redactingTracer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,EAAkB,MAAM,QAAQ,CAAC;AAI7D,OAAO,EAAE,KAAK,mBAAmB,EAAmB,MAAM,qBAAqB,CAAC;AA0BhF,wBAAgB,eAAe,CAAC,SAAS,EAAE,mBAAmB,oCAoB7D"}

package/dist/redactingTracer.js

@@ -1,16 +1,20 @@
-import { Effect, Exit, Layer, Tracer } from "effect";
+import { Effect, Exit, Layer, Option, Tracer } from "effect";
 import { redact } from "@shivaedev/errors/redact.ts";
 import { redactDiagnosticCause } from "@shivaedev/errors/redactCause.ts";
 import { REDACTED } from "@shivaedev/errors/sensitive.ts";
+import { redactionForRpc } from "#RedactionPolicy.ts";
 import { redactRecord } from "#redactingDiagnostics.ts";
 function redactLinks(values, sensitive) {
     return values.map((link) => ({ ...link, attributes: redactRecord(link.attributes, sensitive) }));
 }
-function redactSpan(span, sensitive) {
+function redactSpan(span, policy) {
     const end = span.end.bind(span);
     const attribute = span.attribute.bind(span);
     const event = span.event.bind(span);
     const addLinks = span.addLinks.bind(span);
+    function sensitive(key) {
+        return redactionForRpc(policy, span.attributes.get("rpc.method"))(key);
+    }
     return Object.assign(span, {
         addLinks: (values) => addLinks(redactLinks(values, sensitive)),
         attribute: (key, value) => attribute(key, sensitive(key) ? REDACTED : redact(value, sensitive)),
@@ -26,7 +30,17 @@ function redactSpan(span, sensitive) {
 export function redactingTracer(sensitive) {
     return Layer.effect(Tracer.Tracer, Effect.map(Tracer.Tracer, (tracer) => Tracer.make({
         ...tracer,
-        span: (options) => redactSpan(tracer.span({ ...options, links: redactLinks(options.links, sensitive) }), sensitive),
+        span: (options) => {
+            const method = Option.match(options.parent, {
+                onNone: () => undefined,
+                onSome: (parent) => (parent._tag === "Span" ? parent.attributes.get("rpc.method") : undefined),
+            });
+            const span = tracer.span({ ...options, links: redactLinks(options.links, redactionForRpc(sensitive, method)) });
+            if (typeof method === "string") {
+                span.attribute("rpc.method", method);
+            }
+            return redactSpan(span, sensitive);
+        },
     })));
 }
 //# sourceMappingURL=redactingTracer.js.map

package/dist/redactingTracer.js.map

@@ -1 +1 @@
-{"version":3,"file":"redactingTracer.js","sourceRoot":"","sources":["../src/redactingTracer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAqB,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,SAAS,WAAW,CAAC,MAAkC,EAAE,SAAuB;IAC/E,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;AAClG,CAAC;AACD,SAAS,UAAU,CAAC,IAAiB,EAAE,SAAuB;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;QAC1B,QAAQ,EAAE,CAAC,MAAkC,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1F,SAAS,EAAE,CAAC,GAAW,EAAE,KAAc,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAChH,GAAG,EAAE,CAAC,IAAY,EAAE,IAAiC,EAAE,EAAE;YACxD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC5C,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;YACtE,CAAC;YACD,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvG,CAAC;QACD,KAAK,EAAE,CAAC,IAAY,EAAE,IAAY,EAAE,UAAoC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,IAAI,YAAY,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;KACjJ,CAAC,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,SAAuB;IACtD,OAAO,KAAK,CAAC,MAAM,CAClB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CACpC,MAAM,CAAC,IAAI,CAAC;QACX,GAAG,MAAM;QACT,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC;KACnH,CAAC,CACF,CACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"redactingTracer.js","sourceRoot":"","sources":["../src/redactingTracer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAqB,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAA4B,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,SAAS,WAAW,CAAC,MAAkC,EAAE,SAAuB;IAC/E,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;AAClG,CAAC;AACD,SAAS,UAAU,CAAC,IAAiB,EAAE,MAA2B;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,SAAS,SAAS,CAAC,GAAW;QAC7B,OAAO,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;QAC1B,QAAQ,EAAE,CAAC,MAAkC,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1F,SAAS,EAAE,CAAC,GAAW,EAAE,KAAc,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAChH,GAAG,EAAE,CAAC,IAAY,EAAE,IAAiC,EAAE,EAAE;YACxD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC5C,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;YACtE,CAAC;YACD,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvG,CAAC;QACD,KAAK,EAAE,CAAC,IAAY,EAAE,IAAY,EAAE,UAAoC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,IAAI,YAAY,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;KACjJ,CAAC,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,SAA8B;IAC7D,OAAO,KAAK,CAAC,MAAM,CAClB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CACpC,MAAM,CAAC,IAAI,CAAC;QACX,GAAG,MAAM;QACT,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;YACjB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE;gBAC3C,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS;gBACvB,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;aAC9F,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;YAChH,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAChC,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACpC,CAAC;KACD,CAAC,CACF,CACD,CAAC;AACH,CAAC"}

package/dist/rpcRequestTracing.d.ts

@@ -0,0 +1,5 @@
+import { Layer } from "effect";
+import { RequestTracing } from "@shivaedev/identity/middleware.ts";
+import { type HostRedactionPolicy } from "#RedactionPolicy.ts";
+export declare function rpcRequestTracing(sensitive: HostRedactionPolicy): Layer.Layer<RequestTracing, never, never>;
+//# sourceMappingURL=rpcRequestTracing.d.ts.map

package/dist/rpcRequestTracing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpcRequestTracing.d.ts","sourceRoot":"","sources":["../src/rpcRequestTracing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAEnE,OAAO,EAAE,KAAK,mBAAmB,EAAmB,MAAM,qBAAqB,CAAC;AAEhF,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,mBAAmB,6CAM/D"}

package/dist/rpcRequestTracing.js

@@ -0,0 +1,8 @@
+import { Effect, Layer } from "effect";
+import { RequestTracing } from "@shivaedev/identity/middleware.ts";
+import { requestTracingLayer } from "@shivaedev/identity/server/tracing.ts";
+import { redactionForRpc } from "#RedactionPolicy.ts";
+export function rpcRequestTracing(sensitive) {
+    return Layer.succeed(RequestTracing, (effect, request) => RequestTracing.use((tracing) => tracing(effect, request)).pipe(Effect.provide(requestTracingLayer({ sensitive: redactionForRpc(sensitive, request.rpc._tag) }))));
+}
+//# sourceMappingURL=rpcRequestTracing.js.map

package/dist/rpcRequestTracing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpcRequestTracing.js","sourceRoot":"","sources":["../src/rpcRequestTracing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAA4B,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEhF,MAAM,UAAU,iBAAiB,CAAC,SAA8B;IAC/D,OAAO,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CACxD,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAC7D,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAChG,CACD,CAAC;AACH,CAAC"}

package/dist/safeOtlpSerialization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safeOtlpSerialization.d.ts","sourceRoot":"","sources":["../src/safeOtlpSerialization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAwC,KAAK,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAOzG,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAK,EAAE,SAAS,GAAE,YAA6B,UAE/F;AAkDD,eAAO,MAAM,qBAAqB,8FAUjC,CAAC"}
+{"version":3,"file":"safeOtlpSerialization.d.ts","sourceRoot":"","sources":["../src/safeOtlpSerialization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAwC,KAAK,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAOzG,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAK,EAAE,SAAS,GAAE,YAA6B,UAE/F;AAuDD,eAAO,MAAM,qBAAqB,8FAUjC,CAAC"}

package/dist/safeOtlpSerialization.js

@@ -1,7 +1,7 @@
 import { Effect, Layer } from "effect";
 import { OtlpSerialization } from "effect/observability";
 import { isSensitiveKey, REDACTED, redactText } from "@shivaedev/errors/sensitive.ts";
-import { RedactionPolicy } from "#RedactionPolicy.ts";
+import { RedactionPolicy, redactionForRpc } from "#RedactionPolicy.ts";
 import { redactOtlpUrl } from "#redactOtlpUrl.ts";
 function otlpSensitive(sensitive) {
     return (key) => sensitive(key) || ["db.user", "db.user.name", "db.connection_string"].includes(key.toLowerCase());
@@ -33,32 +33,37 @@ function spanName(span) {
     }
     return span.name;
 }
-function redactTraces(data, sensitive) {
-    function text(value) {
-        return redactOtlpText(value, "", sensitive);
-    }
+function redactTraces(data, policy) {
+    const resourceSensitive = otlpSensitive(policy);
     return {
         ...data,
         resourceSpans: data.resourceSpans.map((resource) => ({
             ...resource,
-            resource: { ...resource.resource, attributes: attributes(resource.resource.attributes, sensitive) },
+            resource: { ...resource.resource, attributes: attributes(resource.resource.attributes, resourceSensitive) },
             scopeSpans: resource.scopeSpans.map((scope) => ({
                 ...scope,
-                spans: scope.spans.map((span) => ({
-                    ...span,
-                    attributes: attributes(span.attributes, sensitive),
-                    events: span.events.map((event) => ({ ...event, attributes: attributes(event.attributes, sensitive), name: text(event.name) })),
-                    links: span.links.map((link) => ({ ...link, attributes: attributes(link.attributes, sensitive) })),
-                    name: text(spanName(span)),
-                    status: { ...span.status, ...(span.status.message === undefined ? {} : { message: text(span.status.message) }) },
-                })),
+                spans: scope.spans.map((span) => {
+                    const method = span.attributes.find(({ key }) => key === "rpc.method")?.value.stringValue;
+                    const sensitive = otlpSensitive(redactionForRpc(policy, method));
+                    function text(value) {
+                        return redactOtlpText(value, "", sensitive);
+                    }
+                    return {
+                        ...span,
+                        attributes: attributes(span.attributes, sensitive),
+                        events: span.events.map((event) => ({ ...event, attributes: attributes(event.attributes, sensitive), name: text(event.name) })),
+                        links: span.links.map((link) => ({ ...link, attributes: attributes(link.attributes, sensitive) })),
+                        name: text(spanName(span)),
+                        status: { ...span.status, ...(span.status.message === undefined ? {} : { message: text(span.status.message) }) },
+                    };
+                }),
             })),
         })),
     };
 }
 export const safeOtlpSerialization = Layer.effect(OtlpSerialization.OtlpSerialization, Effect.gen(function* () {
     const serialization = yield* OtlpSerialization.OtlpSerialization;
-    const sensitive = otlpSensitive(yield* RedactionPolicy);
+    const sensitive = yield* RedactionPolicy;
     return OtlpSerialization.OtlpSerialization.of({
         ...serialization,
         traces: (data) => serialization.traces(redactTraces(data, sensitive)),